HR basics

HR audit log

What is HR audit log?

An HR audit log is a tamper-resistant record of who changed what and when across the system - edits to records, salaries, and leave approvals - used for accountability and compliance.

An audit log turns disputes into facts: who approved that leave, who changed that salary, and when. Good ones mask sensitive fields so the log itself does not leak the data it tracks.

What an audit entry records

A useful entry answers every question about a change on its own, without anyone cross-checking another system or asking around.

Fields of one audit entry

Field	Example	Why it matters
Who acted	Anna Weber, HR admin	Every change has a named person behind it, or "System" for scheduled jobs.
About whom	Marek Nowak	One filter shows an employee's whole history, which settles disputes and answers GDPR access requests.
What happened	updated, approved, login failed	A fixed list of event names keeps the log searchable.
Which record	Leave request, 13-17 Apr	Links the entry to the exact object that changed, such as one leave request.
Before and after	Status: pending -> approved	The old and the new value turn "who changed this?" into a fact.
When	2026-03-03 11:02:14 UTC	Stored in UTC and shown in the reader's time zone, so entries from different offices sort correctly.
Where from	IP 203.0.113.42, Firefox on Linux	Kept for logins and other security events, to spot a misused account.

What an audit log looks like

Here is one employee's month as it appears in the log, oldest entry first. Note what it does not show: the new salary and the new home address.

Sample audit log for one employee

Time (UTC)	Who	Action	Record	Change
2026-03-02 09:14	Anna Weber	updated	Employee profile: Marek Nowak	Position: Developer -> Senior developer
2026-03-02 09:15	Anna Weber	updated	Compensation: Marek Nowak	Amount: [encrypted] -> [encrypted], effective from 2026-04-01
2026-03-03 11:02	Tom Fischer	approved	Leave request: 13-17 Apr, 5 days	Status: pending -> approved
2026-03-04 08:40	Marek Nowak	updated	Own profile	Address: [redacted] -> [redacted]
2026-03-05 22:17	unknown	login failed	Account of Marek Nowak	IP 203.0.113.42, Firefox on Linux, wrong password
2026-04-01 00:05	System	accrued	Vacation balance: Marek Nowak	Balance: 12.5 -> 14.5 days

Masked values are deliberate: the log proves that the salary and the address changed, and who changed them, without becoming a second copy of the data.

One entry under the hood

The salary change from the sample, as it is stored. The amount is masked before the entry is written, so even a raw export of the log does not reveal pay.

One audit entry as JSON

{
  "id": "0192f1c4-7b3e-7a10-9c1d-3f5e8a2b6d41",
  "log": "compensation",
  "event": "updated",
  "actor": { "id": "u-118", "name": "Anna Weber" },
  "subject": { "type": "compensation", "id": "c-2291" },
  "employee": { "id": "u-342", "name": "Marek Nowak" },
  "changes": {
    "old": { "amount": "[encrypted]", "effective_from": "2025-04-01" },
    "new": { "amount": "[encrypted]", "effective_from": "2026-04-01" }
  },
  "created_at": "2026-03-02T09:15:42Z"
}

What to log in an HR system

Log every change someone could later dispute and every event that touches access. Viewing ordinary records usually stays out: logging every page view buries the changes that matter.

Events worth logging

Area	Events
Employee records	Created, edited, terminated, reactivated; manager or department changed
Pay	Salary, pay type and pay schedule changes, with the effective date
Leave	Requested, approved, rejected, cancelled; manual balance adjustments
Access and security	Logins and failed logins, password resets, role and permission changes, support staff signing in as a user
Automated jobs	Leave accruals, year-end carryover, bulk imports - logged with "System" as the actor

What to keep out of the log

An audit log is often kept longer and read by more people than the records it tracks, so it must not become a back door to them. Record that a sensitive field changed and who changed it, and mask the value: salaries, bank details, home addresses, dates of birth.

Some data never belongs in it at all: passwords, reset links and API keys, and health details such as the diagnosis behind sick leave, which is special-category data under GDPR Article 9.

Protect the log itself, too. Entries are only ever added, never edited or deleted from inside the application; only owners and admins can read it; and it is kept for a fixed period, long enough to settle disputes and answer audits, then deleted on schedule.

Related terms

Put these terms into practice

Flat-rate HR for SMBs. 30 days free, no card, cancel anytime.

Start 30-day free trial